CMMC 2.0 maturity levels now shape DoD contract eligibility

At a glance

What this is: Exostar’s update explains how CMMC 2.0 maturity levels now determine whether DoD contractors remain eligible for awards when handling FCI or CUI.

Why it matters: For IAM, PAM, NHI, and broader security teams, the key shift is that control existence is no longer enough, evidence, documentation, and sustained operation now decide whether governance stands up to assessment.

Context

CMMC 2.0 is a governance problem as much as a technical one: organisations must show that security controls are not only present, but consistently operated, documented, and tied to contract scope. In practice, that moves the burden from point-in-time compliance to ongoing evidence management across people, process, and systems. The article is about defence contractors, but the underlying issue is familiar to any programme where access, evidence, and control ownership must survive operational churn.

For identity and access teams, the important connection is lifecycle control. Contract eligibility now depends on whether organisations can sustain security evidence through assessments, subcontractor flow-downs, and current SPRS reporting, which means IAM, PAM, and non-human identity governance all become part of the compliance story when they support CUI or FCI handling. That is a typical pattern for regulated supply chains, not an edge case.

Key questions

Q: What fails when a CMMC self-assessment is based on outdated evidence?

A: The assessment becomes vulnerable when the score no longer matches the live environment. Outdated screenshots, stale exports, and assumed configurations can create a false sense of compliance. In a CMMC context, that is risky because the organisation is attesting to current implementation, not historical intent. The safest approach is to validate evidence against the systems actually in scope before submission.

Q: Why does CMMC 2.0 create contract award risk for DoD suppliers that are not ready?

A: CMMC 2.0 creates contract award risk because compliance is now tied to solicitation requirements, not future intent. If a contractor cannot show the required level, accurate SPRS scoring, and supporting evidence, it may lose eligibility at award. The practical risk is not only remediation cost, but also failed bids, delayed awards, and exposure to scrutiny over compliance statements.

Q: How do teams know whether CMMC controls are actually operating?

A: Teams know controls are operating when they can show current, mapped evidence that matches real system behaviour, not just written policy. Useful signals include configuration baselines, access enforcement records, and repeatable evidence linked to the exact practices under review. If evidence is stale or manually assembled, the control is not operationally reliable.

Q: What should organisations do when subcontractors touch CUI?

A: They should extend evidence and accountability requirements downstream, because flow-down obligations are part of the maturity story. That means contracts, access governance, and assessment artefacts must cover suppliers that can influence CUI handling or the evidence trail. Otherwise, supplier activity becomes a hidden weakness in contract eligibility.

Technical breakdown

Why CMMC 2.0 is a maturity model, not a checklist

CMMC 2.0 measures whether security is embedded into day-to-day operations, not whether a team can collect artefacts before an audit. A checklist approach proves controls exist at a moment in time, but a maturity model asks whether those controls are repeatable, measurable, and sustained through staffing changes, supplier dependency, and assessment cycles. That distinction matters because defence-contract eligibility now depends on evidence of operating discipline, not just policy presence. The practical difference is that governance, documentation, and control ownership become part of the control itself.

Practical implication: Treat CMMC evidence as an operational output of your security programme, not as a separate compliance exercise.

How SPRS, SSPs, and POA&Ms create an evidence chain

SPRS, System Security Plans, and Plans of Action and Milestones form the record that connects stated controls to current compliance posture. SPRS captures the score, the SSP explains how the environment is controlled, and the POA&M documents bounded remediation where gaps remain. If those three elements drift apart, the organisation may have controls in place but no credible account of their current status. For assessment teams, the key technical issue is not simply documentation volume, but whether the evidence chain is coherent, current, and aligned to the contract’s required maturity level.

Practical implication: Reconcile SPRS, SSP, and POA&M content before assessment windows so the evidence trail tells one consistent story.

Why contractor maturity depends on repeatable access and accountability controls

The article’s strongest signal for identity practitioners is that repeatability is now a contractual requirement, not a nice-to-have. In a defence supply chain, access to CUI and related systems must be governed so that ownership, review, and offboarding survive personnel changes and subcontractor handoffs. That creates a direct link between CMMC maturity and IAM, PAM, and NHI lifecycle control. Where access is not attributed, time-bound, and reviewable, organisations struggle to show that security practices are sustainable rather than improvised.

Practical implication: Use lifecycle controls for human and non-human access so evidence survives changes in staff, suppliers, and project scope.

Threat narrative

Attacker objective: The threat is not only data theft but also weakening defence-supply-chain assurance by exploiting immature governance and control evidence.

1. Entry occurs through weak contractor governance, where organisations handle FCI or CUI without a mature, repeatable control environment.
2. Escalation follows when incomplete documentation, outdated scoring, or inconsistent access governance prevents the organisation from demonstrating required maturity at contract award.
3. Impact is contract ineligibility or increased exposure during assessment because the organisation cannot prove that controls are operating as sustained practice.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

CMMC maturity is now an evidence problem, not a policy problem. The article shows that DoD eligibility depends on whether controls can be demonstrated in current, repeatable form, not whether they exist in principle. That shifts the centre of gravity from point controls to governance continuity, where documentation quality and operational consistency matter as much as technical implementation. The practitioner takeaway is that maturity is judged by proof, not intention.

Evidence debt is the new compliance debt. When SSPs, POA&Ms, and SPRS scores are stale or inconsistent, organisations create a gap between actual practice and assessable reality. That gap is especially dangerous in the defence supply chain because it can exist even when teams believe they are “mostly compliant.” The named concept here is evidence debt, and it is what turns a control programme into a contract risk. Practitioners should treat evidence freshness as a first-class control objective.

Repeatability now defines whether access governance is credible. The article’s emphasis on sustaining compliance through personnel changes and supplier complexity means identity controls cannot be treated as one-off administrative tasks. Where human access reviews, third-party access, and non-human access are not lifecycle-managed, the organisation cannot convincingly show that security practices survive operational churn. That makes lifecycle governance the practical bridge between CMMC maturity and contract eligibility.

CMMC also validates the convergence of identity governance and resilience. The framework is not just about locking systems down; it is about whether the organisation can keep proving control under change. That aligns CMMC with broader resilience thinking, where governance, evidence, and operational continuity are inseparable. For identity teams, the implication is clear: access control must be auditable across the full lifecycle, or maturity claims will not hold up.

The market signal is toward operationalised compliance, not compliance theatre. The article reflects a wider shift in regulated environments where written controls are no longer persuasive unless they are continuously evidenced. That trajectory rewards programmes that connect IAM, policy management, and assessment workflows into one accountable model. Practitioners should expect more scrutiny of whether controls are actually sustained, not merely documented.

What this signals

Evidence freshness is becoming a governance control. CMMC-style programmes fail when the organisation cannot show that the current control state matches the record of truth, especially across access governance, remediation tracking, and supplier scope. For identity teams, the lesson is to align review cycles, revocation events, and assessment evidence so the programme can survive change without breaking its audit story.

Contract eligibility now depends on lifecycle discipline. The practical boundary is no longer whether a control exists once, but whether it remains attributable after staff turnover, subcontractor changes, or system updates. That is where identity governance, privileged access, and non-human identity ownership meet compliance execution, and it is the point practitioners should harden first.

For practitioners

• Define the required CMMC level per contract Map each active DoD contract to the applicable CMMC maturity level and confirm whether FCI or CUI is in scope before assumptions harden.
• Reconcile SPRS, SSP, and POA&M records Check that current scores, system narratives, and remediation items align and reflect the same scope, dates, and control state.
• Tighten evidence ownership across control domains Assign named owners for access reviews, policy updates, supplier evidence, and assessment artefacts so records do not drift between teams.
• Validate subcontractor flow-down obligations Confirm that downstream suppliers handling CUI or supporting assessment evidence are contractually bound to the same maturity and reporting expectations.
• Refresh access governance for both people and services Review human privileged access and non-human credentials together so review, revocation, and traceability survive staffing or programme changes.

Key takeaways

• CMMC 2.0 turns maturity into a proof requirement, so organisations must show that controls are operating consistently rather than simply documented.
• The hardest failures are often governance failures, where stale SPRS data, mismatched SSPs, or weak POA&M discipline undermine otherwise real controls.
• Teams should treat evidence ownership, lifecycle access governance, and supplier flow-downs as core parts of contract eligibility, not as administrative afterthoughts.

Key terms

• Cybersecurity Maturity Model: A cybersecurity maturity model is a framework for measuring how well an organization manages security over time. It typically defines staged capabilities, from ad hoc practices to optimized operations, across areas such as governance, identity, detection, response, and resilience. It helps leaders assess gaps, prioritize investment, and track progress.
• SPRS: The Supplier Performance Risk System is a government scoring mechanism used to assess contractor reliability. It captures delivery performance, part correctness, and specification compliance, making it a practical trust signal for whether an organisation can keep receiving work.
• POA&M: A Plan of Action and Milestones is a formal record of control gaps, remediation steps, owners, and timelines. It is useful when gaps are bounded and tracked, but it becomes a governance weakness if it is stale, overused, or disconnected from the current security baseline.
• Flow-down obligation: A flow-down obligation is a requirement that the prime contractor passes relevant security or compliance duties to subcontractors and suppliers. In CMMC contexts, this means third parties may need to demonstrate the same control evidence expected of the primary contractor when handling sensitive federal information.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is suitable for practitioners building governance around human access, non-human identities, and the evidence trails that support mature security programmes.